diff --git a/tests/test_forensics.py b/tests/test_forensics.py
index 17ccf4d..8277b72 100644
--- a/tests/test_forensics.py
+++ b/tests/test_forensics.py
@@ -5,7 +5,7 @@ import stat
 import sys
 from click.testing import CliRunner
 from ctf.utils import load_config, active_categories
-from ctf.forensics import get_metadata, get_flag_strings
+from ctf.forensics import get_metadata
 from ctf.cli_forensics import forensics_group, inspect
 
 # Define the persistent test environment path
@@ -269,42 +269,6 @@ def test_forensics_signatures_cli():
     assert "PNG Image" in result.output
     assert "89504E47" in result.output
 
-def test_forensics_flag_detect_cli_found():
-    """
-    Verifies that 'forensics flag-detect' successfully finds flag patterns.
-    """
-    runner = CliRunner()
-    test_file = TEST_ENV / "flag_data.bin"
-    with open(test_file, "wb") as f:
-        f.write(b"random_data_here_flag{found_statically_in_file}more_data")
-        
-    result = runner.invoke(forensics_group, ["flag-detect", str(test_file)])
-    assert result.exit_code == 0
-    assert "Potential Flag(s) Found" in result.output
-    assert "flag{found_statically_in_file}" in result.output
+# (Old flag-detect tests removed)
 
-def test_forensics_flag_detect_cli_not_found():
-    """
-    Verifies that 'forensics flag-detect' displays 'No flag patterns found.'
-    when no flag matches the pattern.
-    """
-    runner = CliRunner()
-    test_file = TEST_ENV / "clean_data.bin"
-    with open(test_file, "wb") as f:
-        f.write(b"this is a completely normal text file without flags.")
-        
-    result = runner.invoke(forensics_group, ["flag-detect", str(test_file)])
-    assert result.exit_code == 0
-    assert "No flag patterns found" in result.output
-
-def test_get_flag_strings_pure():
-    """
-    Verifies that get_flag_strings extracts expected strings and matching flags directly.
-    """
-    test_file = TEST_ENV / "pure_flag_data.bin"
-    with open(test_file, "wb") as f:
-        f.write(b"pre_flag{hello_world_1337}post_stuff")
-        
-    flags = get_flag_strings(test_file, r"flag\{[a-z_0-9]+\}")
-    assert flags == ["flag{hello_world_1337}"]
 
diff --git a/tests/test_main.py b/tests/test_main.py
index 873ac15..4f665df 100644
--- a/tests/test_main.py
+++ b/tests/test_main.py
@@ -16,3 +16,47 @@ def test_main_entry_point_help():
         
         # Verify it exits with a successful exit code (0)
         assert exc_info.value.code == 0
+
+def test_flag_detector_stream_detection():
+    """
+    Verifies that FlagDetectorStream successfully intercepts writes to output potential flags.
+    """
+    from io import StringIO
+    from ctf.main import FlagDetectorStream
+    
+    out = StringIO()
+    stream = FlagDetectorStream(out, r"flag\{[a-z_]+\}")
+    
+    stream.write("Some text before flag{my_flag_here} and text after.")
+    output = out.getvalue()
+    assert "Potential flag(s) detected in command output" in output
+    assert "flag{my_flag_here}" in output
+
+def test_flag_detector_stream_anchored_stripping():
+    """
+    Verifies that FlagDetectorStream strips standard anchors ^ and $ to support substring searches.
+    """
+    from io import StringIO
+    from ctf.main import FlagDetectorStream
+    
+    out = StringIO()
+    stream = FlagDetectorStream(out, r"^flag\{[a-z_]+\}$")
+    
+    stream.write("random flag{my_flag_here} data")
+    output = out.getvalue()
+    assert "Potential flag(s) detected in command output" in output
+    assert "flag{my_flag_here}" in output
+
+def test_flag_detector_stream_no_pattern():
+    """
+    Verifies that FlagDetectorStream passes through text unmodified if no flag pattern is configured.
+    """
+    from io import StringIO
+    from ctf.main import FlagDetectorStream
+    
+    out = StringIO()
+    stream = FlagDetectorStream(out, "")
+    
+    stream.write("normal output flag{hello}")
+    assert out.getvalue() == "normal output flag{hello}"
+